Performance of different methods across individual corruptions.
First, we show the performance of the simple baselines considered in Sec.  over each of the 15 corruptions of CIFAR-10-C.
We show in Fig. REF  the error rates of the standard and the \(\operatorname{\mathbf {\ell }}_2\)  adversarially trained models and in Fig. REF  a breakdown of the accuracy of all simple baselines (i.e., standard and \(\operatorname{\mathbf {\ell }}_2\)  adversarially trained models, together with the models trained with gradient regularization and Gaussian data augmentation).
We first note that \(\operatorname{\mathbf {\ell }}_2\)  adversarial training leads to better average performance compared to other baselines, and improves on each corruption type (blurs, digital, noises, weather) and particularly on JPEG compression, elastic transform, pixelate, and zoom blur. However, compared to the standard model, adversarial training worsens the performance on contrast and fog, and slightly on brightness as has been observed in previous work for \(\operatorname{\mathbf {\ell }}_\infty \)  adversarial training with a large \(\operatorname{\mathbf {\varepsilon }}={8}{255}\)  [1]}.
Moreover, Fig. REF  complements Fig. REF  and helps to motivate why the LPIPS distance can be more suitable than the \(\operatorname{\mathbf {\ell }}_2\)  distance for the problem of being robust to common corruptions (see the discussion in Sec. ).
